nginx/csp/frontend: ensure POSTs to Sentry are not blocked

files/nginx/odk.conf.template

@@ -105,7 +105,7 @@ map $spa_name $spa_csp {
     "default-src 'report-sample' 'none'; connect-src 'self' https:; font-src 'self' data:; form-action 'self'; frame-ancestors 'self'; frame-src 'self' https://getodk.github.io/central/; img-src blob: data: https:; manifest-src 'self'; media-src blob:; object-src 'none'; script-src 'report-sample' 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; worker-src 'report-sample' blob: data:; report-uri /csp-report";
 
   default
-    "default-src 'report-sample' 'none'; connect-src 'self' https://translate.google.com https://translate.googleapis.com; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'self' https://getodk.github.io/central/; img-src data: https:; manifest-src 'self'; media-src 'none'; object-src 'none'; script-src 'report-sample' 'self'; style-src 'report-sample' 'self'; style-src-attr 'unsafe-inline'; worker-src 'report-sample' blob:; report-uri /csp-report";
+    "default-src 'report-sample' 'none'; connect-src 'self' ${SENTRY_DSN_FRONTEND_ROOT} https://translate.google.com https://translate.googleapis.com; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'self' https://getodk.github.io/central/; img-src data: https:; manifest-src 'self'; media-src 'none'; object-src 'none'; script-src 'report-sample' 'self'; style-src 'report-sample' 'self'; style-src-attr 'unsafe-inline'; worker-src 'report-sample' blob:; report-uri /csp-report";
 }
 
 map $upstream_http_content_security_policy $central_backend_csp {

files/nginx/setup-odk.sh

@@ -15,12 +15,15 @@ fi
 # Generate self-signed keys for the incorrect (catch-all) HTTPS listener.  This
 # cert should never be seen by legitimate users, so it's not a big deal that
 # it's self-signed and won't expire for 1,000 years.
-mkdir -p /etc/nginx/ssl
-openssl req -x509 -nodes -newkey rsa:2048 \
-    -subj "/CN=invalid.local" \
-    -keyout /etc/nginx/ssl/nginx.default.key \
-    -out    /etc/nginx/ssl/nginx.default.crt \
-    -days 365000
+BADHOST_DH_PATH=/etc/nginx/ssl/nginx.default
+if ! [ -s "$BADHOST_DH_PATH.key" ] || ! [ -s "$BADHOST_DH_PATH.crt" ]; then
+  mkdir -p /etc/nginx/ssl
+  openssl req -x509 -nodes -newkey rsa:2048 \
+      -subj "/CN=invalid.local" \
+      -keyout "$BADHOST_DH_PATH.key" \
+      -out    "$BADHOST_DH_PATH.crt" \
+      -days 365000
+fi
 
 DH_PATH=/etc/dh/nginx.pem
 if [ "$SSL_TYPE" != "upstream" ] && [ ! -s "$DH_PATH" ]; then
@@ -45,6 +48,7 @@ echo "writing fresh nginx templates..."
   > /etc/nginx/conf.d/redirector.conf
 
 CERT_DOMAIN=$( [ "$SSL_TYPE" = "customssl" ] && echo "local" || echo "$DOMAIN") \
+SENTRY_DSN_FRONTEND_ROOT="$(awk 'sub(/:\/\/[a-z0-9]*@/, "://") && sub(/\/[0-9]*$/, "")' <<<"$SENTRY_DSN_FRONTEND")" \
 /scripts/envsub.awk \
   < /usr/share/odk/nginx/odk.conf.template \
   > /etc/nginx/conf.d/odk.conf

test/nginx/lib.docker-compose.yml

@@ -18,13 +18,17 @@ services:
       - SENTRY_ORG_SUBDOMAIN=o-fake-dsn
       - SENTRY_PROJECT=example-sentry-project
       - OIDC_ENABLED=false
-      - SENTRY_DSN_FRONTEND=https://abcdef0123456789abcdef0123456789@o-fake-dsn.ingest.sentry.io/1234567890123456
+      - SENTRY_DSN_FRONTEND=${SENTRY_DSN_FRONTEND-https://abcdef0123456789abcdef0123456789@o-fake-dsn.ingest.sentry.io/1234567890123456}
     volumes:
       - ../../files/nginx/odk.conf.template:/usr/share/odk/nginx/odk.conf.template:ro
       - ../../files/nginx/client-config.json.template:/usr/share/odk/nginx/client-config.json.template:ro
       - ./files/nginx/dh.pem:/etc/dh/nginx.pem:ro
     healthcheck:
       test: [ "CMD-SHELL", "nc -z localhost 80 || exit 1" ]
+      interval: 1s
+      timeout: 1s
+      retries: 10
+      start_period: 0s
     restart: always
     logging:
       driver: local

test/nginx/lint-config.sh

@@ -58,6 +58,7 @@ EOF
   log "$service: config looks OK."
 }
 
+docker_compose up --detach --wait
 lint_service nginx-ssl-selfsign
 lint_service nginx-ssl-upstream
 

test/nginx/mock-sentry/index.js

@@ -32,6 +32,7 @@ app.get('/__mock_sentry/reset',       (req, res) => {
   events.length = 0;
   res.json('OK');
 });
+
 app.use('/api', (req, res, next) => {
   log(new Date(), req.method, req.originalUrl);
 
@@ -49,6 +50,20 @@ app.use('/api', (req, res, next) => {
 
   next();
 });
+
+app.use('/api/:projectId/envelope/', (req, res, next) => {
+  res.setHeader('Access-Control-Allow-Origin', 'https://odk-nginx.example.test:9001');
+  res.setHeader('Access-Control-Allow-Methods', 'OPTIONS, POST');
+
+  if(req.method === 'OPTIONS') return res.sendStatus(204);
+
+  next();
+});
+app.post('/api/:projectId/envelope/', (req, res) => {
+  if(req.params.projectId !== '1234567890123456') return res.status(400).send('Unexpected Sentry projectId.');
+  res.send('envelope:OK');
+});
+
 app.get('/api/check-cert', (req, res) => res.send('OK'));
 app.post('/api/example-sentry-project/security/', (req, res) => {
   const { sentry_key } = req.query;

test/nginx/nginx.test.docker-compose.yml

@@ -46,3 +46,18 @@ services:
       - "[::1]:10000:80"
       - "127.0.0.1:10001:443"
       - "[::1]:10001:443"
+  nginx-test-setup-odk:
+    extends:
+      file: lib.docker-compose.yml
+      service: nginx
+    environment:
+      SSL_TYPE: selfsign
+    ports:
+      - "10002:80"
+      - "10003:443"
+    volumes:
+      - ./src/mocha/setup-odk/certs/nginx.pem:/etc/dh/nginx.pem:ro
+      - ./src/mocha/setup-odk/certs/privkey.pem:/etc/selfsign/live/odk-nginx.example.test/privkey.pem:ro
+      - ./src/mocha/setup-odk/certs/fullchain.pem:/etc/selfsign/live/odk-nginx.example.test/fullchain.pem:ro
+      - ./src/mocha/setup-odk/certs/nginx.default.key:/etc/nginx/ssl/nginx.default.key:ro
+      - ./src/mocha/setup-odk/certs/nginx.default.crt:/etc/nginx/ssl/nginx.default.crt:ro

test/nginx/src/mocha/nginx.spec.js

@@ -77,6 +77,7 @@ const contentSecurityPolicies = {
       ],
       'connect-src': [
         self,
+        'https://o-fake-dsn.ingest.sentry.io',
       ],
       'font-src':       self,
       'form-action': self,

test/nginx/src/mocha/setup-odk.spec.js

@@ -0,0 +1,77 @@
+const { execSync } = require('node:child_process');
+
+const { assert } = require('../lib');
+const request = require('./request');
+
+const log = (...args) => console.log('[setup-odk.spec]', ...args);
+const service = 'nginx-test-setup-odk';
+
+describe('setup-odk.sh', function() {
+  describe('SENTRY_DSN_FRONTEND', () => {
+    afterEach(() => {
+      log('--- CONTAINER LOGS ---');
+      dockerCompose({}, `logs --timestamps ${service}`);
+      log('--- END CONTAINER LOGS ---');
+    });
+    after(() => {
+      dockerCompose({}, `down --remove-orphans --volumes`);
+    });
+
+    [
+      [ undefined, 'https://o-fake-dsn.ingest.sentry.io' ],
+      [
+        'https://abcdef0123456789abcdef0123456789@some-dsn.ingest.sentry.io/1234567890123456',
+        'https://some-dsn.ingest.sentry.io',
+      ],
+      [ '', '' ],
+      [ 'bad-format', '' ],
+    ].forEach(([ SENTRY_DSN_FRONTEND, expectedCspEntry ]) => {
+      it(`should generated expected CSP for SENTRY_DSN_FRONTEND='${SENTRY_DSN_FRONTEND}'`, withNginx({
+        SENTRY_DSN_FRONTEND,
+      }, async () => {
+        // when
+        const res = await request(`https://localhost:10003`);
+
+        // then
+        assert.equal(res.status, 200);
+        assert.equal(
+          res.headers.get('Content-Security-Policy'),
+          [
+            `default-src 'report-sample' 'none'`,
+            `connect-src 'self' ${expectedCspEntry} https://translate.google.com https://translate.googleapis.com`,
+            `font-src 'self'`,
+            `form-action 'self'`,
+            `frame-ancestors 'none'`,
+            `frame-src 'self' https://getodk.github.io/central/`,
+            `img-src data: https:`,
+            `manifest-src 'self'`,
+            `media-src 'none'`,
+            `object-src 'none'`,
+            `script-src 'report-sample' 'self'`,
+            `style-src 'report-sample' 'self'`,
+            `style-src-attr 'unsafe-inline'`,
+            `worker-src 'report-sample' blob:`,
+            `report-uri /csp-report`,
+          ].join('; '),
+        );
+      }));
+    });
+  });
+});
+
+function dockerCompose(opts, ...args) {
+  return execSync(
+    `docker compose --file ./nginx/nginx.test.docker-compose.yml ${args.join(' ')}`,
+    { stdio:'inherit', ...opts },
+  );
+}
+
+function withNginx(env, fn) {
+  return async function() {
+    this.timeout(10_000);
+
+    dockerCompose({ env }, `up --build --force-recreate --detach --wait ${service}`);
+
+    await fn();
+  };
+}

test/nginx/src/mocha/setup-odk/certs/fullchain.pem

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFfzCCA2egAwIBAgIUWcYydie7rDEpI3z1R5v9LE1jLG0wDQYJKoZIhvcNAQEL
+BQAwTjELMAkGA1UEBhMCWFgxDTALBgNVBAgMBFhYWFgxDTALBgNVBAcMBFhYWFgx
+DTALBgNVBAoMBFhYWFgxEjAQBgNVBAMMCWxvY2FsaG9zdDAgFw0yNjA3MjcxMjAw
+MjhaGA8zMDI1MTEyNzEyMDAyOFowTjELMAkGA1UEBhMCWFgxDTALBgNVBAgMBFhY
+WFgxDTALBgNVBAcMBFhYWFgxDTALBgNVBAoMBFhYWFgxEjAQBgNVBAMMCWxvY2Fs
+aG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANQUAbhDWEFJ9Qpd
+hlWwVcB80uV/n0CMuqFyYYlIJwzKV5oPGCucbmrLTOzOhw6MPAeFqvmevgoI2CR7
+cVQPqm/9BZ9SSPwWzo/jZ+s+iAg1mVseN2eVTBMCCOh+pU0643e2FaItQ9t6/y3R
+nm5iQvtWasMz5pc4h5iT0YAvBEyloKcSHSC+GG1XlJlNayRFYcCDwVMfaCppdtrh
+3hQr5L3EtStZwn4F1e7+lKc4pdN3t7teEp2tbwgKOg+eGagrKQYBOftROrw27OeY
+CKvMdB7dCaTJzzZ9AyXN+1OhoXyJQPaZS18lcdtIYqUM2arB6CvfClNhTMFdWezq
+Y6Itb0K9TJHjKfYoMG/jo1WSyGOdUB5IBlcoHv/tCd699MjeRmlFyGHo0CZcNlBN
+AEMxzgYFN7k4HPmXkSS/jR3dKTIOVOCHTGLXMajhhLeBV3AQa0xJxca7Hy659tNU
+otCYCNSKNU+oBv1D/CBeqX3eIrZMUuxbRttoGzWqKk/vyH78CiavdGqAmTfWMxPy
+geA5Yxzh0wMfL27Au4P2zl1jNZQIfMZceRbB+NYCtmekBPSoEd+0xiFGaud20iiX
+qnc0YYyJDMCQdh9jAtjJnZWOeDHC5d++d5MwMhKBDeUWdLFsiisp2DJGTaIViGHI
+8f9PAuMEYkAgiXPhq4rnTdCOinaFAgMBAAGjUzBRMB0GA1UdDgQWBBS0Tqk6Sr9z
+Xy1ntRqC2cmwraVq1jAfBgNVHSMEGDAWgBS0Tqk6Sr9zXy1ntRqC2cmwraVq1jAP
+BgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAK+2pRRVJTLoHNw/gH
+AUrAV3t4ORwHg1gTsmZ75lsEn8eTQdozwwQw3pYGYy+/2vzOStFOTUqUWx+C/8dL
+xREZVzttYKaXeRfiHtSe1tssPCX64NBVGmhYddctS/EK1Qo4fqKJEnfV0fLgHP2j
+M2cRxxU8c5WjqN1ONAuARTVexwIOQjxXMQ9q1f8AWCeWqITDqA6gbzNoH6M45qBC
+qMJU4aEGcNGbCJjaOU9XHzcqcxJMh4S734Z801XbTdbKXIuHnjv2aix1NPhMqMpt
+0NSzrwwTGJ0YrPH4aigodU7hRk8lu6wdWHHz8M9f2DJUDc/WOiV1lVaFoJ5zdgoX
+e9Rdd26UmI5t2fB4dP6BeIxREST14iaqPx9dNsZ8xBUc3jaSsxw+RSEUbSruD+F2
+AQbsdy/9andnpWbYWbMJyvgX1I24Q2FRApNNaOq4iQ2NCNp8dTi6jqgPt/aW9mvo
+bHsxeMkpDeeFrNyM4vMJziUIL6Qv7uzsnXJEhdxSjMnGL28dKt88SaijektvKxV4
+89sP0txmVLka3ZtJUWThMrFFhr2XVjX1D7qPpYidDye0+QGrMHNiJmKXK1tMO/jX
+Nvl4MpY2nIQSLbC0cTUT3cXA16smHcXc5IBgivP7LFzGmY2z/XRJEg7/G8oJU8F8
+VGhBK7TJH3Nk0t1XTcPOycFmag==
+-----END CERTIFICATE-----

test/nginx/src/mocha/setup-odk/certs/nginx.default.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDEzCCAfugAwIBAgIUQ8snjPkbecZEi5nsUDu+h+HGt60wDQYJKoZIhvcNAQEL
+BQAwGDEWMBQGA1UEAwwNaW52YWxpZC5sb2NhbDAgFw0yNjA3MjcxMTMxMDNaGA8z
+MDI1MTEyNzExMzEwM1owGDEWMBQGA1UEAwwNaW52YWxpZC5sb2NhbDCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBANvaxvPqKiZBh/rr9az9d+DN1EBS2obX
+V5sYtrD3FvXnvXK6LDmp8gzEKt4VgZWlcjAG2XKYslxlKuMvAwNR5LBNNYNm9U8H
+OYnpM/ww0wXTZzPW91KI+8cusLgUSu7pYE9WD1zwdTTLpM3xEgm1BN1ZJgwcdekg
+AP/FMnPeLyhfvoRdR17O0zx9e/SuHD8N26SLfsNjuGmj7Ig0u9N/XQhGfznpKn7+
+KzPslcHvJIbFH2/qpS2q+3a09ruKr6XK8vSbDkV7u6azz7fx3RPoPyDJwscv+z5S
+R/hHoRqpLhgxfTVvmF+dzMjlzMsEObMeyJArQ+u6CjzLWyrh+je3LVUCAwEAAaNT
+MFEwHQYDVR0OBBYEFA43O6gGRRB2kTK33NqPjq5FCvrJMB8GA1UdIwQYMBaAFA43
+O6gGRRB2kTK33NqPjq5FCvrJMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBAF2Iu6+nP/t41FTQfNA4NHYJR83wgnVsavO62TwXI6jgRs+WbI9xVLaZ
+JSd9nQDjc9VLuNfC95an/YYmQ7n/QIpGrIMwv4PqqOh3QYdDQ58NcXqYn1I0Ecbf
+WjgGcypM63Wl9tCvrRWXSDjsBgRR7uUK685u+3k+moBCMZTccyoK5br4LbPZ0mVg
+YT1EapMwgv2SSYfZq77qpSxggzTrYESX49qVHb5GhixODboFAHP6DPYqQW/1Td/4
+ndc56oxTH90If+A6j/Jw/+zh8NCbru3Jj1WgViwZxgupokAQvGmuO2tL+TrPdMtq
+tszgT/URHrVuPW5fvyJfbYfEJdP3c2Q=
+-----END CERTIFICATE-----

test/nginx/src/mocha/setup-odk/certs/nginx.default.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDb2sbz6iomQYf6
+6/Ws/XfgzdRAUtqG11ebGLaw9xb1571yuiw5qfIMxCreFYGVpXIwBtlymLJcZSrj
+LwMDUeSwTTWDZvVPBzmJ6TP8MNMF02cz1vdSiPvHLrC4FEru6WBPVg9c8HU0y6TN
+8RIJtQTdWSYMHHXpIAD/xTJz3i8oX76EXUdeztM8fXv0rhw/Dduki37DY7hpo+yI
+NLvTf10IRn856Sp+/isz7JXB7ySGxR9v6qUtqvt2tPa7iq+lyvL0mw5Fe7ums8+3
+8d0T6D8gycLHL/s+Ukf4R6EaqS4YMX01b5hfnczI5czLBDmzHsiQK0Prugo8y1sq
+4fo3ty1VAgMBAAECggEAIBAjOUHShVNDx0yfvuuVTs/9zya2L3ma0Wf0htD2RIUY
+PDHaDsvR3NpEDTDyPdaL1WS+VCfgRTjM3SaHSDXqheqwrfn3NyAM3GfJ+NLPB7e5
+wpXsallHbNhKlgIBnp+i99cLdQitczZq0c0BTjCb5cMhWR1Sdd4Av0xtS/gghQDS
+Ub4hFkSSPz8CPj6fEmzFrdBpR3NSELxuYT7yvaXhJJSLltL675KEOif7uP9e9gdL
+aGIsB47kpHxNiAh+Pj2kLMAgLV5bokSZ0y7lQGr0HYCWqx/+/SQEeB7PDuNPgqpz
+/2PT6d/eQ6FIandthpj7T4XaO4uRjLiELsPW7yOVQQKBgQD5WLtYUTp7oSMQN0Um
++z0/XKfaCDZHu03fqvDEw7cIKtNfWajcaBoCUDATFl4PQ0hFdiaOhYQ/Om6ms6ue
+B5Mbeuu1WDxhAJw6WMCfyInJTdbUwml4+Y8K4mxYYsi29XaLwZs//dyVs3l9Uhc2
+5HLSBBESM9Efljx2gP7jfT3clQKBgQDhuJZtfgRJrwvgHl+pe8WgQ0DKeyIK/DnG
+q7EgOGDEmQziJB8SZFcM+29fyl+GrA3ugge8NnCI5Ilhc6iOC8v7iyrOVIw+6q5Z
+6MPoGr4q0Kj8h7h9pQT6dIMtntSAiaTm3QYVLIvgcUJkMmm6CiqtMOPO3AApvZWc
+red2dPsdwQKBgQCQpVq41xY4FbgDdiyVenWDRjrRDqZ+YjfAoqddXbPV9xH7ZEXC
+5lkAMohQ6k7SR9OrB+lCEE4xZ7I83kmWOQqrjFkkL/WGyBXY+xdzGaBkuNUBQ25w
+EUVbqRH1DAknqamFVWC8dIX8CctWWcLBwzCgiF9m0cxkqICWtiomycaTKQKBgD2U
+FP3D7jmH1q6KusBK8uw4zLkwhGYIz15CwqyulL+tnVUoU4258AGrqoOwewULdTWH
+JcMT+vltl4kNe4Nc9oYmPkRRznzvmycOGDv+57hYenGCOTOVzFjjZlIQzZpPcrxE
+uf8WywYs/9bD5hIJ6gCboNpzLFw2y1UWIFoxqbxBAoGBAJQaA1sJPK0cuVxV6lB5
+2C6a7p+daUiOIFTjFiVhwkXwF/7zvBYkOhKZvScRppkbOHNxgKV3u0k7N+/SLD1B
+GjcSXUekIh0PVKFrl3pbkHzUsvXWALtVHBhhxmuJDziWxoYAEXjL2E2ljUHveK6O
+wgI/D1jYMJCNWG1aDtQbGnrh
+-----END PRIVATE KEY-----

test/nginx/src/mocha/setup-odk/certs/nginx.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAqCDbAQxEgnE/pp4Dj2d+5D9NA2aqbZRxaJ9xYcawpSYoB1+IND0I
+ft0bskkQ0vdMtUrrbHCG2mgeXyo+91jGo3MSrzSkxMVbX5xOSNe6CoMF88kweTcX
+h9qoUoj/hpqDRXyVbfz4UIKrJCtSTGB1FjS4v/B1DxsqB9jKL4bCM1vc4R5ismnV
+XhIlO5czsQut2okgqb5txsn0l/p4OrPj486DRxN90CBdwKRWnTjYbklHnmCDabiy
+1n+/XE5uPLKjyoaxWwsAFJ42zHA+z2h9SdDKhmL1+ozfW5T96grtUa/LhS9HpihS
+nZDH5tr6ZkynpzsbXLhtfRnMEsiKIvA6dwIBAg==
+-----END DH PARAMETERS-----

test/nginx/src/mocha/setup-odk/certs/privkey.pem

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDUFAG4Q1hBSfUK
+XYZVsFXAfNLlf59AjLqhcmGJSCcMyleaDxgrnG5qy0zszocOjDwHhar5nr4KCNgk
+e3FUD6pv/QWfUkj8Fs6P42frPogINZlbHjdnlUwTAgjofqVNOuN3thWiLUPbev8t
+0Z5uYkL7VmrDM+aXOIeYk9GALwRMpaCnEh0gvhhtV5SZTWskRWHAg8FTH2gqaXba
+4d4UK+S9xLUrWcJ+BdXu/pSnOKXTd7e7XhKdrW8ICjoPnhmoKykGATn7UTq8Nuzn
+mAirzHQe3Qmkyc82fQMlzftToaF8iUD2mUtfJXHbSGKlDNmqwegr3wpTYUzBXVns
+6mOiLW9CvUyR4yn2KDBv46NVkshjnVAeSAZXKB7/7QnevfTI3kZpRchh6NAmXDZQ
+TQBDMc4GBTe5OBz5l5Ekv40d3SkyDlTgh0xi1zGo4YS3gVdwEGtMScXGux8uufbT
+VKLQmAjUijVPqAb9Q/wgXql93iK2TFLsW0bbaBs1qipP78h+/Aomr3RqgJk31jMT
+8oHgOWMc4dMDHy9uwLuD9s5dYzWUCHzGXHkWwfjWArZnpAT0qBHftMYhRmrndtIo
+l6p3NGGMiQzAkHYfYwLYyZ2VjngxwuXfvneTMDISgQ3lFnSxbIorKdgyRk2iFYhh
+yPH/TwLjBGJAIIlz4auK503Qjop2hQIDAQABAoICAGW1KpX6BitZkqDj9XbG2Hk1
+49aYfAFy/FZNCqXR6phhud1ye77+iJ3C3iN7cJ3zdx6MZlDMZotdbnsgkFsmIDER
+AU9FISd0sJ+lCcNx+78kJWXjeeK9YPyEr00A37nIEirpMjrSxoZN2G9a5kY97a2n
+5g+zplTDkZQE4CY/Zip0DDXTpBB92i0mIWfcDxQYCidPiLmaiFQ+u/eA9wZpfovb
++J7Pr0zM86pogVYo/q4J7h13oinocSVD8lBnHBrgiA4PLIVwkWCOXtM6wH3T0aSz
+kNpsxml1Trskq/GRxGZ7VKJvJgx9YrstXdGV9hXEZNoVX1hZg3wAjw3l4t52N7LE
+BTJEiViYGgSpqsiioj+7KzuEXQVVjReqnW069abx1iDds+9CC6XRvODDoqbGDjJ7
+3hQrFcxYrTBJP5QFIbiyGbRUwEavnoII5cuo6yR3BeCZdkSM2XRytiEt7OdSbAXu
+1vampdtKPwqrm7ygnfl7Ew0MVKayHe9W5QYSMj6Oxu0TwBu1lOBCnGGOwBVE0dJd
+ATExEmdpQY14WTxGrpwjQS83MkuUEJL4uf7tDMjxEfvstH8PUzWd+kjFN+Y0A1ef
+yAI/DUuWC2r8gh+nfQjFehpGhSqKsrQb6c2hQTppxj4iU8ZMwbuNSAB9mKYqPU8i
+55N7oMuO6ocOcnzERQ8JAoIBAQD7CIjRfhsSip9B8nOD+/MgvPbjD4LkUeDpXfLA
+LOCMuBkG8sEQUND48yphqUCfwxLaaU+2YyI61RcEw/X6RrqFbwZWAaX0af40bJcl
+OT/4huox1ZCGxxx1J6MRvPDaQHKl3HOmaFYBkTQodq34CJkJo7PAr7uhig7ToRG7
+yL26FLAbrmWqtCcs2c5ToIh8rhL8lhKjADRcMgSlkm0I1H2fjiqQlJjIlsaCZ6te
+6cds/VIIiR3s+ao7ozWrLcVbdr1I0O1GrsMQhLrhhuDm4qs80/zhtuigHvVPReGO
+HluvEnS4w/PN0ux82Oey7EPN9yNTOrK9pQ1yVmKCVF981KFXAoIBAQDYRirGi1Cr
+5zrlGqs/AqJCAPoDZeG3QzLbr8SANYZaihKB0CnMHAefnJflvaasAFtbzXNiqS5Z
+DooJTjQdSXiYVnJKRq+ounVMUNP0ADw6aH/gl/OVugN52G0KHBgDWNtksKa5bxH9
+5gUhYFdZRMLbmI97//WT7pi3QYrF9NWYg0EGpGJTy/aVy5hRDHqbZrS1Gq34XiPN
+EDHf6fpbGuce4eoqVKTCE6GY3YFbLoNf1vPB90sHD44/slKynnPhV8szqSHUrCae
+cg2/Ule47XEAD1B5ShTbdJZ8bG8nMSWtCrMY+4sDiC3G66vCDbdwyucYn7SWQLkg
+SsPPnREIT/GDAoIBAQDWVoojfS32Xd/u+emBttz3hgCzDKpw8iw8dZfwWCD+Za4Q
+zbLkkGxtM4prSo1AG9p8HFEQZIJ0gz8dNYhPwpY9mfdp9gxRrTJ8Zn+DK+ef9un9
+1OCLA3Ub3tUQLyfi4gZB8gHZAtr0iZtkNTkDP6wTm++9xQ5KtktEjRFMKfE88a8Q
+Y46w+xM761iM9NO0yRizDBwriuAqHBb1nBl24Z/FXSigvA/brUkfTQ74gllhiMXD
+PfgMP3wHYapQV0tcdfzWMHV31X3+G6ZJK9XZrY4R6NrRilADb4t6vSsCIo+b4wFA
+RSdlBQQg8T6b+blHIg3KYaL94/CgQHvp1cqWFiMPAoIBAQDNrKT/XfvhDyyGNn+G
+k8WlCXK6CojGlMRoAdbYqo5TyhzhkQo+zqU9WFloJZy81DYNruu9dvDZxqblRJbx
+By8FiKh2FJT23COy6Oc4k4Szcy+xcjA3QsgNdxHzXFZF0JoMPqa/kG5GzBoy7IEF
+Jww8c/B4Vym/fleDZ3RG35jFyoTrgSb1U/Hz8MOwyDJNWTYfSPkLStO3L2CO9d+e
+Bo6nYucjTI3G945lZrme8jQDz9LOspOKanO4Baj5rxC6y5g2T/EZZIHxiruiJ/e+
+qSgei3HXdukw7sYyG5j1Z5rR3mwGJSnFuRr3oqYcDJlYTc3KMA84GOM1X4SqC0/o
+XMZrAoIBADdFD/kBHYgeZhYOFIC+aDoQ7ZDyNpjfmsFPKJJ4kOXfXEu9lIpJZR19
+d5iJJJTOo8N6VNMCSAjXoLrLGuNRlvtClIgCGawdV6CkEX7JRE6AETABntpGg17p
+e7FVvWIYl2kDO0Zc3nXQD4lIg2LrDJ06lHyWJvYCyvWkrklh0RDhtoknOunqjhd4
+XqjAX0UbRM6VICkAjDW9UIl5zCJZkUl5jXEgD8OdnX3/SLG+ZSNk0T9M1GYfmIxO
+bfCLlWJIQlcl+B8VvuCf1Sxai+JMUHZSZ1Kk3gtAsEFPDBnrSMfEN/GIt77XjAta
+CXrD8tbLW0whHwPpmeoIxdZrpnNPu8U=
+-----END PRIVATE KEY-----